Method for authentication

Abstract

A method for authentication of a first party, A, to a second party, B, by a trusted third party, C, is disclosed. A is registered at C, and the method comprises the steps of receiving a identification data of A from A; determining, based on the identification data, if A has the right to request a random private key, RPK; and generating a temporary RPK. Further, C combines the RPK and a random open key, ROK, to form a single use temporary master authentication code; transmits the RPK to A; and, upon receipt of the RPK and the ROK from B, determines if the received RPK and ROK matches a valid single use temporary master authentication code; and authenticates, in case of match, A to B. The first party, A, may be any handheld device, such as a mobile phone, or a PDA, or a stationary device, such as a stationary computer or an ATM. The communication between the parties may be wired or wireless. A corresponding system is also disclosed.

Description

TECHNICAL FIELD[0001]The present invention relates to a method for authentication of a first party to a second party, by a trusted third party. The present invention also relates to a corresponding system.BACKGROUND OF THE INVENTION[0002]Methods for identification of one party to another party that are communicating via electronic media are widely used. Examples of applications where identification of the user is needed are withdrawing from an ATM, controlling a remote computer over the internet, using an internet banking system, performing a payment transaction when webshopping, etc. Several well known principles exist within this field of technology.[0003]Conventionally authentication has been performed via user name and password, offering a relatively low security. For a higher security the so called two factor authentication has been used, meaning that a combination of for example something the user knows and something the user has, such as a PIN and a bank card, are needed for ...

AI Technical Summary

Benefits of technology

[0024]Thus, an advantage of the present invention is that the first party may be unknown to the second party, since the authentication process is performed via the trusted third party. Further, an advantage is that the first party does not need to transfer any ID to the second party. However, the first party also communicates directly with the second party, which feels more natural and is more effective than if all communication would pass a trusted third party. The direct communication between the first party and the second party makes the method of the present invention suitable for usage in for example stores.

Problems solved by technology

Although providing a method with a higher security than conventional methods, a problem with the method disclosed in WO2006075917 is that the entire code is created in the user device, by means of an algorithm which is based upon a user personal code, a user device ID and if necessary a service provider code, to be compared to a corresponding code at the service provider, meaning that the entire code exists in its complete form, and is stored in both the user device and the service provider, which reduces the security.

Another problem with the method disclosed in WO2006075917 is that the code can be associated to a certain user.

Further, several of the conventional methods for identification are only adapted for remote communication between two parties, such as the method disclosed in WO0235487, which limits the range of use considerably.

Common problems of conventional methods for authentication are that they are often complicated to use and / or do not provide a high enough security level.

Yet another problem with the methods used today is that the predictability often is high.

Images